Executive brief
AVideo is a popular open-source video streaming platform. The LiveLinks plugin contains a stored XSS vulnerability where an attacker with streaming permissions can inject malicious scripts into video link titles and descriptions that execute in the browsers of all site visitors, including administrators. This could allow attackers to steal admin credentials, perform unauthorized actions, or compromise visitor sessions.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) in the LiveLinks plugin where title and description fields are accepted without sanitization or HTML purification. An authenticated user with canStream permission can inject malicious JavaScript through the addLiveLink.php endpoint when onlyAdminCanAddLinks is disabled. The injected payloads (e.g., <img src=x onerror=alert()>) are stored in the database and rendered without escaping on the public Live.php page, causing arbitrary script execution in the browser context of every visitor including administrators. No patch was available at the time of advisory publication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-26: disclosed
- 2026-09-10: advisory